Loading...
Skip to main content
GeekWala

CVE-2025-46558 — Vulnerability in...

CRITICAL

org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content

Published April 30, 2025Updated May 1, 2025Source: osv

Summary

### Impact The Markdown syntax is vulnerable to XSS through HTML. In particular, using Markdown syntax, it's possible for any user to embed Javascript code that will then be executed on the browser of any other user visiting either the document or the comment that contains it. In the instance that this code is executed by a user with admins or programming rights, this issue compromises the confidentiality, integrity and availability of the whole XWiki installation. To reproduce, on an instance where the CommonMark Markdown Syntax 1.2 extension is installed, log in as a user without script rights. Edit a document and set its syntax to Markdown. Then , add the content `<script>alert("XSS")</script>` and refresh the page. If an alert appears containing "XSS", then the instance is vulnerable. ### Patches This has been patched in version 8.9 of the CommonMark Markdown Syntax 1.2 extension. ### Workarounds We're not aware of any workaround except upgrading. ### References * https://jira.xwiki.org/browse/MARKDOWN-80 * https://github.com/xwiki-contrib/syntax-markdown/commit/d136472d6e8a47981a0ede420a9096f88ffa5035

Advisory Timeline

  • First published April 30, 2025 (530 days ago).
  • Last revised May 1, 2025 — 1 day after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.xwiki.contrib.markdown:syntax-markdown-commonmark12 to 8.9 or later
<!-- Update pom.xml dependency version to 8.9 for org.xwiki.contrib.markdown:syntax-markdown-commonmark12 -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: maven (1).

PackageEcosystemAffectedFixed In
org.xwiki.contrib.markdown:syntax-markdown-commonmark12
maven
All versions8.9

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

  • CWE-79
    Cross-site Scripting (XSS)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.0 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2025-46558?
org.xwiki.contrib.markdown:syntax-markdown-commonmark12 vulnerable to XSS via Markdown content This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.0/10).
How do I check if my project is affected by CVE-2025-46558?
CVE-2025-46558 affects org.xwiki.contrib.markdown:syntax-markdown-commonmark12. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-46558 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.0

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-8g2j-rhfh-hq3r

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies